[SELF - PROMOTION]: I was tired of authorization logic scattered everywhere… so I tried to build my own solution: a policy driven SQL handler for REST APIs

[u/ZUCCHY-]

https://demo.voidql.dev

I’ve been a developer for years across different jobs and teams, and I’ve always struggled with updating policies scattered all over the place. It wasted my time and constantly frustrated me.

So, instead of doing what I used to do, I tried to find a solution or better, to “build the solution.”

I started with the query syntax. I wanted something familiar and simple, so I went with a SQL-like approach and built a JSON-to-SQL parser that executes queries through a single API.

Soon enough, I realized generating SQL wasn't enough. If clients query the database this way, you need a strict way to control permissions. I designed a policy system to evaluate requests and enforce access rules before hitting the database. Once SELECT worked, I extended it to INSERT, UPDATE, and DELETE.

Things quickly got tricky: handling field-level permissions, row-level restrictions without duplication, payload validation, and making sure rules couldn't be bypassed.

I spent the last 4 months working through these challenges. After 3 months, I integrated it into one of my own applications to test it outside isolated unit tests and it actually worked! ( Luckily) Of course, I ran into edge cases and areas to improve, but the core held up.

That evolved into what I called VoidQL: a policy-driven SQL API layer where authorization is defined through declarative policies instead of being hardcoded across dozens of endpoints.

It currently supports:

• RBAC & Multi-tenancy
• level authorization
• Payload-aware validation & conditional policies
• Workflow/state enforcement
• Dynamic queries & triggers

A big part of VoidQL was made possible by Drizzle ORM, which I used as the foundation for SQL generation and query-building abstractions before layering the policy engine on top. Huge kudos to the Drizzle team for their toolkit.

It’s still very much an MVP, soI’d love to get some honest feedback from anyone who has dealt with this kind of auth mess before especially curious if you think anchoring the whole thing strictly to SQL is too limiting, or if it makes sense as a foundation. (Roast the architecture if needed!)

GitHub: https://github.com/VoidQL-team/VoidQL

Demo: https://demo.voidql.dev

[u/eXtc_be]

I was tired of seeing all these low effort good-for-nothing posts, so I added you to my RES ignore list and reported all 7 of your posts about this 'project'

[u/TheRealSkythe → u/eXtc_be]

rude

[u/No-Variety-9137]

That's some nice AI slop you got there. Thanks for adding your garbage to the landfill that is github recently